The patch for CVE-2023-5367 X.Org server: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty
has to be imported into the xserver component shipped by NoMachine server packages.

Ref.
https://lists.x.org/archives/xorg-announce/2023-October/003430.html

Albeit this doesn't affect NoMachine, the fix for CVE-2023-5380: Use-after-free bug in DestroyWindow will be imported as well.

The fix for CVE-2023-5574: Use-after-free bug in DamageDestroy will be instead not imported because NoMachine doesn't use Xvfb, which is the only component affected.